> ## Documentation Index
> Fetch the complete documentation index at: https://shield.fi/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Administrative control risks

> Capabilities, concentration, misuse cases, and mitigating procedures.

The admin controls market availability, fee settings, asset admission, protocol-fee collection, and position freezes.

## Capabilities

The admin can:

* Add fee tiers and tick spacings
* Bind or rebind a fee to a spacing
* Register token decimals once
* Allow tokens for pool creation
* Open or close public pool creation
* Enable or disable a pool
* Pause globally, by token, or by pair
* Set the protocol fee share for a pool
* Collect recorded protocol fees to a chosen recipient
* Freeze and unfreeze positions
* Nominate a new admin

## Admin and investigator concentration

`DEPLOYER` and `SWAP_INVESTIGATOR_KEY` are the same hardcoded address. At initial deployment this combines operational administration and compliance-record decryption under one account unless custody arrangements separate the underlying capabilities.

Admin transfer does not rotate the investigator recipient. The old investigator remains able to decrypt new records.

## Misuse and compromise cases

* Venue or market denial through pause controls
* Incorrect token decimal registration, which is write-once
* Risky asset admission through the token allowlist
* Unexpected fee and spacing rebinding for future pools
* Excessive protocol fee share within the allowed range
* Protocol fee collection to an unauthorized recipient
* Position immobilization without adequate authority or review
* Loss of investigator confidentiality through key compromise

The contract exposes no user-fund seizure function for frozen positions, but a freeze blocks that position's exit until unfreeze.

## Multisig limit

The imported multisig check applies only to upgrades above edition zero. Routine admin calls require `self.caller` to match the `admin` mapping.

## Mitigations

* Use a dedicated operational control account with threshold approval.
* Separate investigator custody from admin signing.
* Require a signed manifest for decimals, tokens, fees, and pools.
* Apply dual approval for protocol fee collection and position freeze.
* Monitor every admin mapping change and transfer.
* Reconcile control transactions against a case or change record.
* Test emergency pause and recovery procedures.
* Maintain an investigator-key upgrade or redeployment plan.

## User disclosure

Publish the admin address, governance design, control scope, freeze effect, pause matrix, fee limits, and change history.